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(57) ABSTRACT 

A compu ter watchdog system monito rs and controls distri- 
"^ution content sent form producers, through distributors, to 
subscribers. The computer watchdog system acting to ensure 
the just execution of agreements between a producer of 
content and a distributor of content. The computer watchdog 
system serving as an agent trusted by both producers and 
distributors. The computer watchdog system may be 
equipped with tamper protection for resisting exogenous 
attempts lo gain unauthorized access to the system. The 
computer watchdog system may be installed entirely within 
distributor's sites. Alternatively, the computer watchdog 
system may reside partially within distributor's sites and 
partially within subscriber's sites. The computer watchdog 
system logs and reports on information relating to the 
distribution of content. Further, the computer watchdog 
system may selectively transform content provided by a 
producer, customizing the content for distributors and sub- 
scribers. 

29 Claims, 6 Drawing Sheets 
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WATCHDOG FOR TRUSTED ELECTRONIC 
CONTENT DISTRIBUTIONS 

FIELD OF THE INVENTION 

The present inventioo relates to electronic content distri- 
bution and more particularly to a computer watchdog system 
providing a secure communication channel. Specifically, a 
system is described for securing the distribution of elec- 
tronic content from a producer, through a distributor, to a 
subscriber. 

BACKGROUND OF THE INVENTION 

Before proceeding it is helpful to define the following 
terms: 

Content: any material that is possible to distribute elec- 
tronically to consumers, such as, for example, 
advertisements, movies, recorded music, world wide web 
pages, or the like. Electronic content refers to material that 
may be distributed digitally, such as, for example, sampled 
music, digital video, or the like. 

Producers: makers of content, such as, for example, an 
advertiser, an actor, a movie production company, a music 
production company, or the like. 

Distributors: owners of communication channels, such as, 
satellite companies, cable-TV companies, telephone 
companies, Internet access providers, or the like. 

Subscribers: members of the general public that are 
consumers of content, such as, individuals receiving cable- 
TV, individuals with access to the Internet, or the like. 

Viewer: a device, such as, for example, a personal com- 
puter and/or work station, used to view content, visually as 
well as audibly. 

Many producers of electronic content provide electronic 
content to various content distributors. The content 
distributors, in turn, select and route electronic content to 
subscribers. For example, a producer of electronic content 
may be an advertiser providing national advertisements to 
local cable-TV distributors. The local cable-TV heads, in 
turn, select national advertisements provided by the 
advertiser, insert these national advertisements into the local 
cable-TV programming, and provide the programming with 
the inserted advertisements to cable subscribers. FIG. 1 is a 
block diagram illustrating the distribution of advertisements 
from several advertisers 102, 104, and 106, through a 
content distributor HO, to subscribers 120, 122, 124, 126, 
and 128. 

Payment agreements between a producer of content and a 
distributor of content depend on the content that is received 
by subscribers. The content received by subscribers may be 
classified as either "art" or "advertising". When the content 
received by subscribers is deemed "art** the content distribu- 
tor pays the content producer per distribution of content to 
subscribers. When the content received by subscribers is 
deemed "advertising" the content producer pays the content 
distributor per distribution of content to subscribers. 

For example, suppose video is the medium by which 
content is distributed. Pay-per-view movies in hotel rooms 
received via cable and/or satellite links is content that is 
deemed "art**. In this case, the cable and/or satellite com- 
pany is the content producer, the hotel is the distributor of 
pay-per-view movies, and subscribers, receiving these 
movies, are the hotel occupants. An example of video 
received by subscribers that is deemed "advertising** is the 
example given above in which a distributor selects and 
inserts national advertisements in local cable-TV program- 
ming. 
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In the case where the medium by which content is 
distributed is the world wide web, an example of content that 
is deemed "art" is a retail site offering digitized music for 
sale. In this case, the owner of the rights to the digitized 

5 music is the content producer, the owner of the retail site is 
the content distributor, and anyone with access to the Inter- 
net is a potential subscriber. An example of content distrib- 
uted over the world wide web that is deemed "advertising" 
is advertisements appearing in on-line newspapers and/or 

10 magazines. In this case, the content producer is the 
advertiser, the distributor is the owner of the on-line maga- 
zine and/or newspaper, and a subscriber is anyone with 
access to the on-line magazine and/or newspaper. FIG. 2 is 
a block diagram illustrating the distribution of content from 

15 producers 202, 204, 206, 208, and 210, through distributors 
220, 222, and 224, to subscribers 230, 232, 234, 236, 238, 
240, and 242. 

The infrastructure conventionally used to distribute con- 
tent from producers, through distributors, to subscribers is 

20 shown in FIG. 3. FIG. 3 shows: a producer's site 302, a 
distributors site 310, content distribution channels 320, and 
subscriber's sites 322, 324, and 326. The producer's site 302 
includes a preparation engine 303 for packaging electronic 
data in preparation for distribution. The distributors site 310 

25 includes: a content receiver 312, a device for receiving 
content provided by a producer; a content archive 314, a 
device for storing data (e.g. digital music, video, and/or 
advertisements); a distribution engine 316, a mechanism for 
determining when and what content to distribute to a sub- 

30 scriber 322, 324, and/or 326 via the content distribution 
channels 320; and a bypass 318, for bypassing the content 
archive 314, sending content directly from the content 
receiver 312 to the distribution engine 316. Both the content 
receiver 312 and the distribution engine 316 may commu- 

35 nicate with the content archive 314. The subscriber's sites 
322, 324, and 326, each include a viewer for viewing 
multimedia data. 

A fundamental diflSculty with the distribution of content 
as illustrated in FIG. 3 is that in order to comply with the 
payment agreements between a producer of content and a 
distributor of content, a trustworthy measurement of the 
content received by subscribers is required. It may be 
possible to alter the distribution infrastrucmre to accommo- 
date measurements of content received by subscribers. A 

^5 measurement of content received by a subscriber may be, for 
example, the number of pay-per-view movies watched, the 
number of musical pieces downloaded from the Internet, 
and/or the number of times a particular on-line magazine 
was accessed. The content distributor may measure the 
content received by subscribers. Alternatively, meters may 
be introduced at subscriber sites in order to allow a content 
producer to measure content received by subscribers. In 
either case, the content producer and content distributor need 
to trust one another. Either the content producer or the 
content distributor may, through malice and/or by bungling, 
skew the measurement results. For example, with content 
decmed^ dv^'-r^^'^'ng- the ^ distributor may increase his rev- 
enuc by pretending to distribute content to a larRC number of 

^^UDscribcrs. Another example of fraud by content 

^0 distributors, such as a TV or radio broadcasting company, 
occurs when the distributor miscalculates the residual roy- 
alties due performers (content producers) appearing in, for 
example, advertisements. 

65 SUMMARY OF THE INVENTION 

A computer watchdog system processes a producer set. 
The producer set is provided by a producer. The computer 
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watchdog comprises: a processing engine for creating a tion that is requested, by a producer and/or a distributor, 

plurality of records of distribution content and for geaerating from a computer watchdog system. For example, a report 

a plurality of reports based on the producer set; a distribution may include all pertinent information regarding one particu- 

log for storing the plurality of records of distribution con- lar piece of data that the producer sent to the distributor, e.g. 

tent; and an authenticated execution unit for validating a set 5 content X received by distributor Y, content X archived at Z 

ofopcrationspcrformedby the processing engine and trans- time, content X distributed to subscriber S, content X 

mitting an authenticating signal responsive to said set of removed from archive. 

operations being validated. Tamper protection: any mechanism for protecting against 

BRIEF DESCRIPTION OF THE DRAWINGS unauthorized access to the information stored in, and the 

10 operation of the computer watchdog system. Tamper pro- 

FIG. 1 is a block diagram illustrating the distribution of tection may include logic and other circuitry to detect, for 

advertisements from an advertiser, through a content example, temperature and voltage changes that are outside 

distributor, to subscribers, of a pre-specified operating range. The presence of X-rays, 

FIG. 2 is a block diagram illustrating the distribution of and/or physical intrusion (e.g. mesh intrusion) through the 

content from producers, through distributors, to subscribers. outer layers (skin) of the watchdog, may also be detected. 

FIG. 3. is a block diagram which is helpful in understand- The safety and security of distribution of content from a 

ing the infrastructure conventionally used to distributed producer, through distributors, to subscribers may be 

content from producers, through distributors, to subscribers. enforced by a computer watchdog system. A computer 

FIG. 4 is an illustration of an exemplary watchdog in watchdog system may be installed at the distributors site or 

accordance with an exemplary embodiment of the present location. The watchdog will monitor and control informa- 

invention. tion related to the distribution of content, provided by a 

FIG. 5 is a block diagram which iUustrates an infrastruc- producer, and delivered (distributed) to subscribers by the 

ture used to distribute content from producers, through distributor. The watchdog may thus serve as an agent that is 

distributors, to subscribers in accordance with an exemplary 25 producers and distributors. The processing 

embodiment of the present invention operations of the watchdog facilitate the implementation of 

FIG. 6 is a block diagram which iUustrates an infrastruc ^^^ements between a producer and a distributor, by pro- 

ture used to distribute content from producers, through viding each with relevant Irus^vorthy mformab^^ 

distributors, to subscribers in accordance with an exemplary ^^^^^^^^ its distribuUon. The watchdog may be 

embodiment of the present invention. ^^igned to carry out the monitonflgandxpntroLopfccMioDs. 

justly while resistin gjexogenous atje napts at ta mpering. 

DETAILED DESCRIPTION OF THE An exemplary watchdog 400 in accordance with a first 

INVENTION embodiment of the present invention is shown in FIG. 4. The 

Before proceeding it is helpful to define the following watchdog 400 includes: a processing engine 402, a distri- 

jecfQg. 35 bution log 404, and an authenticated execution unit 408. The 

Cbmputer watchdog system: a system that may be imple- "'^'^r^ ' ^i^?"*'.*' ^T^vf 

mented in hardware, software or both for monitoring and l^^l'^ ^r'^^r ^ fr ^ ""f " ^ ?^ °^ 

.IV 1 * • * * J- * -u * J J records of distribution content from the producer set. These 

controlling electronic content distributed from a producer, „ u * j • * -u i a^m 

. J- , -u ^ ♦ u -u * f *u records may be stored m the distribution log 404. By 

through distributors, to subscnbers. The system enforces the „,.„«.oo;«r, »L «f ^- . u * * 5 .u • r 

just execution of distribution agreements between producers « PTt^n L^r^-T f 1^,. ' ^, " 

and distributors of content. mation stored m the log 404, the pro^sing engme <W2 may 

, ^ . generate a plurahly of reports 406 contaimng pertinent 

Records of distribution content: records that may include information, 

unique identifiers of the content. These records may also i , • , , 

include information that a producer and/or a distributor may , '^"7''' f ^' ^T'""^ 

want to verify concerning the distribution of content. For « f^^°'^^^^y packaged data ^at Ae producer has sent to a 

example, the date and time the data had been received and/or ^.s^butor as weU as mformat.on that a producer wishes the 

distributed, the size of the data, the length (in time) of data ^"'^J^^^S 'o jstore m a distribution log. Such electronicaUy 

transmission, the format of the content (eg. TV ^P^ckaged^data may contain, for example^TV 

transmission, music, or the like), the identity of the ^ advf rtise^^StTak well as a tmie-stam ^thatgagag^^ 
distributor, the identity of subscribers, and information ,,i^i.^JSJl^,^!^:[ ^^^'!^^°^ ^^^^ 

ing to the customizing of data for both distributors and >. sizTSf-ffie-aaySHisement. Reconds o XdjsatoUQii-conlent^ 

subscribers, may be included in the records. such as a time-stamp and size information aUow a watchdog, 

r,. . ■. •• 1 1 . • • J f J. ... • to report to a producer the length of tim e it ta ke th e 

Distnbution log: a log oontaming records of distnbution - di,,rihmnr m receive riM» anH t« ve.rifv thM »ii ,h. h,,^ 



content. 



distributor to receive data, and to verifv that all the data had 
been rece ived by the distributor, fi, proneRsinfi e.np^fne. may 



Proccssmg Engme: a computer includmg a central pro- Sparse the data to create and log such records of distribution 

cessing unit, a memory, and an input/output interface. content in the distribution log. Furthermore, the processing 

Archive: a device for storing data. engine may, accessing the log, generate a plurality of reports 

Authenticated execution unit: cryptographic means allow- containing information that is pertinent to the producer 

ing the watchdog to determine the validity of programs, that go and/or distributor. 

either reside in the watchdog or are sent to the watchdog by The distribution log 404 contains records of the content, 

a producer or by a distributor, to be executed by the of a producer set, received and/or distributed by a disU-ibu- 

processing engine. Once validity is established the watchdog tor. These records of distribution content may include unique 

may authenticate the operations performed by the processing identifiers of the content. The records may also include 

engine to a producer or distributor at a remote location. 65 information that a producer and/or a distributor may want to 

Reports: include information ranging from the entire verify concerning the distribution of content. For example, 

contents of the distribution log, to a subset of the informa- the date and time the data had been received and/or 
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distributed, the size of the data, the length (in time) of data cryptographic coprocessor executing software that may be 

transmission, the format of the content (e.g. TV developed using IBM 4758*s OEM development environ- 

transmission, music, or the like), the identity of the ment. 

distributor, the identity of subscribers, and information relat- The infrastructure used to distribute content from 

ing to the customizing of data for both distributors and 5 producers, through distributors, to subscribers in accordance 

subscribers, may be included in the records. with another embodiment of the present invention is shown 

The plurality of reports 406 may include information in FIG. 5. FIG. 5 shows: a producer's site 502, a distributors 

ranging from the entire contents of the distribution log, to a site 510, content distribution channels 520, and subscriber's 

subset of the information that is requested, by a producer sites 522, 524, and 526. The producer's site 502 includes a 

and/or a distributor, from the watchdog 400. For example, jg preparation engine 503, for packaging electronic data in 

one report of the plurality of reports 406 may include all preparation for distribution. The distributors site 510 

pertinent information regarding one particular piece of data includes: a watchdog 515, a content receiver 512, a device 

that the producer sent to the distributor; e.g. content X for receiving content provided by a producer; a content 

received by distributor Y, content X archived at Z time, archive 514, a device for storing data (e.g. digital music, 

content X distributed to subscriber S, content X removed video, and/or advertisements); a distribution engine 516, a 

fromjrchive.- mechanism for determining when and what content to 

The authenticated execution unit 408 may be imple- distribute to a subscriber 522, 524, and/or 526 via the 
mentcd in software that resides in the watchdog 400. The content distribution channels 520; and a bypass 518, for 
authenticated execution unit 408 lends the watchdog 400 the bypassing the content archive 514, sending content directly 
capability to determine the validity of programs, that cither 20 content receiver 512 to the distribution engine 516. 
reside in the watchdog 400 or are sent to the watchdog 400 Both the content receiver 512 and the distribution engine 
by a producer or by a distributor, to be executed by the 516 may communicate with the content archive 514. The 
processing engine 402. Hence, the authenticated execution watchdog 515 communicates with the distribution engine 
unit 408 may prevent unauthorized software from being run 516. The subscriber's sij es 522, 52 4, and 526, each include 
by the watchdog 400. The authenticated execution unit 408 25 ^ viewer for viewing jn ultimedia'9atg> FIG. 5 also shows a 
may also prevent the counterfeiting and/or forgery of the watchdog-producer l^p~504rThe"loop 504 is a communi- 
watchdog 400 by a device attempting to masquerade as the cation path through which a producer may query the watch- 
watchdog 400. The operations performed by the processing dog 515 concerning the verification of infonnation in the 
engine 402 may be validated by the authenticated execution plurality of reports generated by the watchdog 515. 
unit 408 b.i Lverifying a digt al signature against a certificate 30 Once content has been packaged by the preparation 
coqlami ng a cryptograp hic l^ j^ Hence, the watchdog may engine 503 at the producer's site the producer sends a 
authenticate~the operations performed by the processing producer set to a distributor. The producer set is received by 
engine to a producer or distributor at a remote location. For the content receiver 512. The distribution content of the 
example, an authenticated execution unit may include the producer set may then be stored in the content archive until 
ability to control when and how the watchdog 400 receives 35 a decision is made to distribute the content. Alternatively, the 
software updates, and the ability to authenticate messages distribution content may be forwarded directly to the distri- 
from the watchdog 400 to a remote device. bution engine 516 using the bypass 518. Once the decision 



A trustworthy watchdog may be designed to be resistant is made to distribute content the distribution engine 516 

to exogenous tampering. Tamper protection may include notifies the watchdog 515 of the content to be distributed, 

logic and other circuitry to detect, for example, temperature 40 The watchdog 515 may then log all the information that is 

and voltage changes that are outside of a pre-specified relevant to the current distribution of content. The distribu- 

operating range. The presence of X-rays, and/or physical tion content is then distributed to subscribers 522, 524, 

intrusion (e.g. mesh intrusion) through the outer layers and/or 526, via the content distribution channels 520. The 

(skin) of the watchdog, may also be detected. The watchdog stibscribers 522, 524, and/or 526, receive the content or data, 

may respond to an attempt at tampering by "zero-i2ing" 45 In variation to the embodiment, in accordance with the 

(erasing) memory that is otherwise non -volatile. The present invention, shown in FIG. 5, an infrastructure to 

memory to be "zero-ized" when a tampering attempt is distribute content from producers, through distributors, to 

sensed, may contain secret cryptographic keys and other subscribers as shown in FIG. 6 may be used. The distributors 

information that allows a watchdog to authenticate itself and site 610 includes: a watchdog 615, a content receiver 612, a 

the resident software. In other words, tamper protection 50 device for receiving content provided by a producer; a 

renders some subset of the memory unavailable, either by content archive 614, a device for storing data (e.g. digital 

destroying it ("zero-ization") or by making it physically music, video, or advertisements); a distribution engine 616, 

unavailable. "Zero-ization" may not destroy the contents of a mechanism for determining when and what content to 

a watchdog's memory, but rather destroy the ability of a distribute to a subscriber 622, 624, and/or 626 via the 

watchdog to (cryptographically) prove that it is authentic. 55 content distribution channels 620; and a communication bus 

For example, tamper protection employed by a watchdog 617, linking the watchdog 615 and the content archive 614. 

may be designed to meet or exceed the requirements of the Both the content receiver 612 and the distribution engine 

US government's FIPS 140-1 standard for a level 4 cryp- 616 communicate with the watchdog 615. The watchdog 

tographic module. Tamper protection prevents unauthorized 615 communicates with the content archive 614. 

access to the contents of a watchdog. 60 The infrastructure for distributing content from producers, 

A watchdog with tamper protection may be referred to as through distributors, to subscribers shown in FIGS. 5 and 6 

an untampered device. An un-tampered device is a watchdog may be used in conjunction with a trusted watchdog (515, 

that is able to authenticate itself to a producer, for example, 615, respectively) performing not only passive monitoring, 

as a valid watchdog, running authenticated software; i.e. all but active interception and processing of a producer set as 

(^secret cryptographic keys) and information are intact. A 65 well. The watchdog 615 of FIG. 6, is shown communicating 

computer waichdog system as described in the foregoing with the content archive 614 via the communication bus 617. 

may be implemented, for example, using the IBM 4758 Hence, the watchdog 615 may access any data (e.g. digital 
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the distribution log may contain information describing what 
selection and transformation programs were applied to 

which content. — — 

The selection programs may use information that is 
fed-back to a distributor's site from subscriber sites. This 
information feedback may be used by the watchdog to 
customize distribution content. For example, if a subscriber 
is searching the Internet for information about running, a 
watchdog may select advertisements (content) for the sub- 
scriber (for insertion in the Web pages viewed by the 
subscriber) that are related to running; e.g. advertisements 
for running shoes. 

The following table illustrates some examples of trans- 
formation and selection for both the art and advertising 
categories of content. 



Art 



Advcrtuing 



20 



Distributor Selection Select which hotels of a 
chain of hotek are to 
receive what set of 
movies. 



Select which cable-TV 
companies are to receive 
what set of 
advertisements. 



25 



Distributor 
Transformation 



Shut off access to movies Block transmission of 
for hotels that have not particular advertisements 
to particular cable-TV 
companies. 

Change the language of 
an advertisement 
depending on the 
distributor's location. 



paid the producer. 

Embed cryptographic 
watermark in movies 
based on a hotel's 
identity. 



Subscriber Selection Authenticate a subscriber Change advertisement 



music» movies, and/or advertisements) that is intended for 
distribution and subsequent receipt by subscribers. The 
contents of the content archive, however, may not be pro- 
tected from tampering. Though the watchdog may discern if 
anything in the content archive had been tampered with, the 
watchdog may not be able to prevent such tampering. 
Therefore, for purposes of security, data, information, and/or 
programs stored in the content archive may be analyzed by 
the watchdog. Additionally, the watchdog may absorb, fully 
or partially, the functionality of the distribution engine, thus 
increasing the flexibility of the watchdog in monitoring and 
controlling the flow of data from distributor to subscriber. 

The producer prepares a producer set. The producer set 
may include: raw data, to be transformed into distribution 
content, a distribution selection program for selecting dis- 
tributor specific information from the data, and a distributor 
transformation program for processing the data for receipt 
by a distributor. The distributor transformation program 
prepares a distributor set. The distributor set may include: 
raw data, to be transformed into content for a subscriber, a 
subscriber selection program, for selecting subscriber spe- 
cific information from the data, and a subscriber transfor- 
mation program for customizing the data sent to individual 
subscribers. 

The watch dog receives a producer set, logs the receipt, 
and executes the distribution selection program to determine 
if a particular distributor is to receive the data. The watchdog 
may store some of the data of the producer set in the content 
archives For example, an advertisement may be packaged by 
a producer for a particular retail chain store with information 
that specifies that the advertisement applies only to store 
locations in a pre-specified area. The selection program 
determines if a particular distributor is in the pre-specified 
area or not, and whether or not to distribute the advertise- 
ment to subscribers. 

If a distributor is to receive the data, the watchdog 
executes the distributor transformation program to prepare 
content for the distributor's site. If the transformation is 
successful the watchdog may store some information or data 
in a content archive and retain some information or data 
internally. An unsuccessful transformation may take several 
forms, including: content not meant for distribution to a 
particular distributor and/or an associated set of subscribers, 
incorrect content, and unsecure program(s) included in the 

data. In case of an unsuccessful transformation the watchdog 45 To communicate to a watchdog whether or not content 
may lo g the event and/or discard the_data . possibl yjiotifying. . had actually reached the subscriber in the appropriate demo- 
graphic class, and/or whether content had reached a sub- 
scriber at all, a watchdog computer system may be equipped 
with watchpuppies. The watchpuppies are trusted devices 
residing in subscriber's sites. Watchpuppies installed in all 
or some of the subscriber sites may work in concert with a 
watchdog installed at a distributors site. The watchpuppies 
may further provide information that is helpful in distin- 
guishing subscribers that are human from subscribers that 
are automatons, e.g. web search engines. In addition, the 
watchpuppies may assist in monitoring user-to-cached-copy 
interactions of subscribers as well as server-to-cache inter- 
actions. A watchpuppy may be implemented by, for 
example, the IBM 4758 cryptographic coprocessor, IBM 
MultiFunclion Card (IBM MFC 4.0 smart card), as well as 
smart cards from Schlumberger and other vendors, such as 
smart cards supporting standards for security cards like the 
lSO-7816 set of standards. Alternatively, subscriber sites 
may be provided with all of the functionality of a computer 
watchdog system. 

A watchdog may embed data intended for a watchpuppy, 
into the content to be distributed. The watchpuppy may then 



Subscriber 
Transformation 
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by verifying a digital 
signature against a 
certificate containing a 
public encryption key. 



Embed subscriber and 
distributor identifies 
in a cryptographic 
watermark. 



sent to subsciiber based 
on the time of day. 
Block advertisements for 
producers who have not 
paid distributor. 
Resolve contention 
between two advertisers 
competing for one slot 
Change set of goods 
advertised by a retailer 
based on an inferred 
interest (e.g. rcfcrrcr 
field, cookies, content of 
Wcb page) of a 
subscriber. 



Jhej)rod uger and/or the distributor of the failure. 

The distribution engine, or alternatively the watchdog, 
decides when some content is to be distributed, and the 
watchdog selects and executes a subscriber selection pro- 
gram. The watchdog may retrieve data and information 
stored in the content archive. The decision to distribute 
content may be based on several inputs. For example, the 
time and date, expiration of content and/or subscriber selec- 
tion programs, and stored records of distribution content. 
Tlie watchdog then executes a subscriber transformation 
program. Both distributor and subscriber transformation 
programs customize data for the particular use of subscrib- 
ers. These transformation programs may control, for 
example, the language of a voice/sound track to be 
distributed, depending on the ethnic makeup of the target 
subscribers. These programs may additionally control, for 
example, the volume level of the voice/sound track to be 
distributed to subscribers, depending on factors like the age 
group of the subscribers. Note that selection and transfor- 
mation programs may be intemal to a watchdog, loaded into 
a watchdog, and/or stored in a content archive. Furthermore, 
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scan all incoming content for such embedded data and log thorized access to the computer watchdog system by modi- 

the receipt of the data. Hence, the watchpuppy may verify fying portions of system memory. 

that distributed content was actually received by subscribers. 8. A computer watchdog system as recited in claim 1, 

A channel between the distributor and the subscriber may be wherein each of the plurality of reports include at least one 

secured by utilizing a security protocols for communications 5 of ^^e plurality of records of distribution content stored in 

between a watchdog and a watchpuppy. A security protocol distribution log. 

such as. for example. IPSEC, see RFC 1825: Security ^ ^ computer watchdog system as recited in claim 1, 

Architecture for the Internet Protocol. Naval Research Lab. ^j^^^^"^ ^^.^^ pluraUty of reports include at least one 

August 1995, RFC 1826: IP Authentication Header. Naval f' ^'^"^ receipt, date of data receipt, size of data 

Research Lab, August 1995. RFC 1827: IP Encapsulating lO ^^."^^ f ^^l^ transmission, format of content, idenUty of 

Security Payload (ESP). Naval Research Ub. Auglist 19951 ^loT^T/w^^^ . h • . • 1 

ccT Tn, cci D- / 1 t- V E D u- 1 /J 1 J A computer watchdog system as recited m claim 1, 

SSL, see He SSL Protocol, by K. E. B Hickman (developed ^^erem the producer set deludes: data, at least one of a 

my iMetscape communications Corporations), Uecember piuraUty of distributor selection instructions, at least one of 

1995, The IETF s internet draft: HTTP Over TLS. dated ^ ^^^^^^^y distributor transformation instructions. 

March 1998; or the like may be used. Such a protocol may is n. a computer watchdog system as recited in claim 10, 

be more secure than a software-only implementation, wherein ones of the plurality of distributor selection instruc- 

because of the tamper resistant nature of the watchdog and Hons selects ones of a plurality of distributors based on data 

watchpuppy. Moreover, the implementation of a security included in the producer set. 

protocol may result in better performance due to hardware 12. A computer watchdog system as recited in claim 10, 

acceleration of cryptographic algorithms within the watch- 20 wherein ones of the plurality of distributor transformation 

dog and watchpuppy, instructions embed a cryptographic watermark in data 

Although illustrated and described herein with reference included in the producer set. 

to certain exemplary embodiments, the present invention is ^ computer watchdog system as recited in claim 10, 

nevertheless not intended to be limited to the details shown. wherem ones of the plurality of distnbutor transformaUon 

Rather, various modifications may be made in the details 25 instructions produce at least one of: subscriber data, at least 

within the scope and range of equivalents of the claims and P^V'^^'y ""^"u ' instructions at least 

„r;tv,™.t fL^ ^J^t tu^ '»,,^^f'^^ of * plurality subscnber transformation instructions. 

without departing from the spinl of the invention. -.^ * L *^ . u-j 4 •* j • i • ^-^ 

™, t 1 d- 14. A computer watchdog system as recited m claim 13, 

nai IS Claimed: wherein ones of the plurality of subscriber selection instruc- 

1. Acompuler watchdog system for processing a producer i^^ns authenticate a subscriber by verifying a digital signa- 
set provided by a producer, the computer watchdog com- 30 against an encryption key. 

pnsing: j5 ^ computer watchdog system as recited in claim 13, 

a processing engine for creating a plurality of records of wherein ones of the plurality of subscriber transformation 

distribution content and for generating a plurality of instructions embed subscriber and distributor identities in a 

reports based on the producer set; cryptographic watermark, 

a distribution log for storing the plurality of records of ^ method of processing a producer set provided by a 

distribution content- producer to a distributor for distribution to a subscriber, 

' . . , . . comprising the steps of: 

an authenticated execution unit for validatmg a set of ^^^^^ distributor's location a computer watchdog 

operations performed by the processing engine and system for* 

transmitting an authenticating signal responsive to said 40 creating a pluraUty of records of distribution content; 
set of operations being vaUdated; and generating a plurality of reports based on the producer 
tamper protection means for detection of unauthorized set; 
access to the computer watchdog system by detecting storing the plurality of records of distribution content; 
one of a plurality of tamper indicators, wherein the validating a set of operations performed on the pro- 
plurality of tamper indicators include at least one of: 45 ducer set; 

temperature change, voltage change, presence of transmitting an authenticating signal to the producer on 

X-rays, physical intrusion. a watchdog-producer communication loop if said set 

2. A computer watchdog system as recited in claim 1, of operations are validated; and 

wherein the processing engine includes means for preparing detecting unauthorized access to the computer watchdog 

a distributor set by selectively transforming the producer set. 50 by being responsive to a plurality of tamper indicators 

3. A computer watchdog system as recited in claim 2, which include at least one of temperature change, 
wherein the processing engine includes means for custom- presence of X-rays, and physical intrusion. 

izing the distributor set by selectively transforming the 17. A method of processing a producer set according to 

distributor set into subscriber data. claim 16, fiirther comprising the step of preparing a dis- 

4. A computer watchdog system as recited in claim 1, 55 tributor set by selectively transforming the producer set. 
further comprising a watchpuppy for verifying ones of the 18. A method of processing a producer set according to 
plurality of records of distribution content. claim 17, further comprising the step of customizing the 

5. A computer watchdog system as recited in claim 1, distributor set by selectively transforming the distributor set 
wherein the plurality of records of distribution content each into subscriber data. 

include a unique identifier of content. 60 19. An article of manufacture comprising a computer 

6. A computer watchdog system as recited in claim 1, usable medium having computer readable program code 
wherein the plurality of records of distribution content each means embodied therein for processing a producer set 
include at least one of: lime of data receipt, date of data provided by a producer to a distributor for distribution to a 
receipt, size of data, length of data transmission, format of subscriber, the computer readable program code means in 
content, identity of distributor, identity of subscribers. 65 said article of manufacture comprising computer readable 

7. A computer watchdog system as recited in claim 1, program code means for causing a computer watchdog to 
further comprising tamper protection for preventing unau- effect: 
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(a) creating a plurality of records of distribution content; 

(b) generating a plurality of reports based on the producer 
set; 

(c) storing the plurality of records of distribution content; 

(d) vahdating a set of operations performed on the pro- 
ducer set; 

(e) transmitting an authenticaling signal if said set of 
operations are validated; and 

(Q providing tamper protection for detecting unauthorized lo 
access to the computer watchdog by being responsive 
to a plurality of tamper indicators including at least one 
of temperature change, presence of X-rays, and physi- 
cal intrusion. 

20. An article of manufacture as recited in claim 19, the is 
computer readable program code means in said article of 
manufacture further comprising computer readable program 
code means for causing a computer to effect: 

preparing a distributor set by selectively transforming the 
producer set, 20 

21. An article of manufacture as recited in claim 20, the 
computer readable program code means in said article of 
manufacture further comprising computer readable program 
code means for causing a computer to effect: 

customizing the distributor set by selectively transform- 
ing the distributor set into subscriber data. 

22. A computer program product comprising a computer 
usable medium having computer readable program code 
means embodied therein for causing processing a producer 
set provided by a producer to a distributor for distribution to 
a user, the computer readable program code means in said 
computer program product comprising computer readable 
program code means for causing a watchdog computer 
located at the distributor's location to effect: 

(a) creating a plurality of records of distribution content; 

(b) generating a plurality of reports based on the producer 
set; 

(c) storing the plurality of records of distribution content; 

(d) validating a set of operations performed on the pro- 
ducer set; 

(e) transmitting in response to a producer query an 
authenticating signal on a watchdog-producer commu- 
nication loop if said set of operations are validated; and 

providing tamper protection for detection of unauthorized 
access to the computer watchdog by being responsive 
to a plurality of tamper indicators including at least one 
for temperature, change, presence of X-rays and physi- 
cal intrusion. 

23. A computer program product as recited in claim 22, 
the computer readable program code means in said computer 
program product further comprising computer readable pro- 
gram code means for causing a computer to effect: 

preparing a distributor set by selectively transforming the 55 
producer set. 

24. A computer program product as recited in claim 23, 
the computer readable program code means in said computer 
program product further comprising computer readable pro- 
gram code means for causing a computer to effect: 

customizing the distributor set by selectively transform- 
ing the distributor set into subscriber data. 

25. A storage device readable by machine, tangibly 
embodying a program of instructions executable by the 
machine to perform method steps for processing a producer 65 
set provided by a producer to a distributor for distribution to 

a subscriber, said method comprising the steps of: 
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(a) creating a plurality of records of distribution content; 

(b) generating a plurality of reports based on the producer 
set; 

(c) storing the plurality of records of distribution content; 

(d) vahdating a set of operations performed on the pro- 
ducer set; 

(e) transmitting an authenticaling signal is said set of 
operations are vaUdated; and 

(Q providing tamper protection for the detection of unau- 
thorized access to the computer watchdog by being 
responsive to a pluraUty of tamper indicators including 
at least one for temperature change, presence of X-rays 
and physical intrusion. 

26. A computer watchdog system for processing a set of 
advertisements provided by an advertiser and distributed by 
a distributor, characterized by a computer watchdog located 
at the distributor's site comprising: 

a processing engine for creating a plurality of records of 
distributed advertisements and for generating a plural- 
ity of reports based on the set of advertisements; 

a distribution log for storing the plurality of records of 
distributed advertisements; 

an authenticated execution unit for validating a set of 
operations performed by the processing engine and 
transmitting an authenticating signal responsive to said 
set of operations being vahdated; 

a watchdog-producer communication loop through which 
the producer may query the watchdog; and 

tamper protection to detect unauthorized access to the 
computer watchdog by being responsive to a plurality 
of tamper indicators. 

27. A computer watchdog system as recited in claim 26, 
wherein the processing engine includes means for preparing 
a cable TV distribution set by selecting ones of the set of 
advertisements and changing the language of ones of the set 
of advertisements. 

28. A computer watchdog system for processing a pro- 
ducer set provided by a producer to a distributor for distri- 
bution to a user, charaaerized by a computer watchdog at 
the distributor's location comprising: 

a processing engine for creating a pluraHty of records of 
distribution content and for generating a plurality of 
reports based on the producer set; 

a distribution log for storing the plurality of records of 
distribution content; 

an authenticated execution unit for validating a set of 
operations performed by the processing engine and 
transmitting an authenticating signal responsive to said 
set of operations being validated; and 

tamper protection logic for detecting unauthorized access 
to the computer watchdog system by detecting one of 
a plurality of tamper indicators, wherein the plurality of 
tamper indicators include at least one of: temperature 
range, voltage change, presence of X-rays, physical 
intrusion. 

29. In a computer watchdog system for processing a 
producer set provided by a producer to a distributor for 
distribution to a user characterized by, a computer watchdog 
at the distribution location comprising: 

a processing engine for creating a plurality of records of 
distribution content and for generating a plurality of 
reports based on the producer set; 

a distribution log for storing the pluraUty of records of 
distribution content; 



04/26/2004, EAST Version: 1.4.1 



us 6,219, 

13 

an authenticated execution unit for validating a set of 
operations performed by the processing engine that 
either reside in the computer watchdog system or are 
sent to the computer watchdog system by the producer 
or by a distributor, and transmitting an authenticating 5 
signal responsive to said set of operations being vali- 
dated; 
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a watchdog-producer communication loop through which 
the producer can query the watchdog; and 

tamper protection logic responsive to unauthorized access 
to the computer watchdog. 

« * * « * 
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ABSTRACT 



A method and architecture for rewarding a merchant that 
operates a server on a computer network, and in particular 
on the Internet, when a consumer accesses the server and 
later access a server of a paying merchant, i.e. a merchant 
who has agreed to provide a reward to one or more of the 
merchants the consumer accessed on the way, in tracing a 
course through the network, to accessing the paying mer- 
chant. The invention involves having a service operate 
servers, on the computer network, that automatically dis- 
tribute any reward provided by a paying merchant. The 
method is not intended to reward all merchants visited by a 
consumer on the way to a paying merchant; it distributes 
rewards only approximately, trading off accuracy for a lower 
burden of computation. 

9 Claims, 3 Drawing Sheets 
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Merchant registers with 
RPAS 



Merchant selects commission 
rate (% of credits awarded to 
merchant that merchant will 
pass on to other merchants) 



With k-1 = number of 
merchants to be 
compensated with z referral 
points (by merchant m_1), do 
the following: 



Merchant desgns web site to 
trigger access (by redirection) 
to RPAS checkpoint server 



Fig. 2 
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Set i=i+1 
lfi>2, setz=z-a_(i-1) 
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No 



With p_i as % merchant m_i 

will pass on to other 
merchants, award merchant 

mj amount: 

aj=z*(1-pj) 




Fig. 4 
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Mode 1 is entered if 

redirection to 
checkpoint server Is 
followed by ID of 
single registered 
merchant. 



Consumer visits merchant 
web site. 




r 


Consumer is redirected to 
RPAS checkpoint server. 




r 


RPAS checkpoint server 
records visit by consumer to 
merchant web site. 




r 


RPAS ched 
enters mod 


(point server 
el, 2, or 3. 



IVIode 2 is entered if 
redirection to 

checkpoint server is 
followed by ID of two 
registered merchants. 



RPAS checkpoint 
server sets cookie on 
consumer's computer. 



Mode 3 is entered if 

redirection to 
checkpoint server is 
followed by ID of 
registered merchant 
who awards refen'al 
points. 



Fig. 3 
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METHOD AND ARCHITECTURE FOR 
MULTI-LEVEL COMMISSIONED 
ADVERTISING ON A COMPUTER 
NETWORK 

CROSS-REFERENCE TO RELATED 
APPLICATIONS 

This application claims priority from Provisional Appli- 
cation No. 60/079,223, Qled Mar. 24, 1998. 

FIELD OF THE INVENTION 

The present invention pertains to the field of advertising 
on a computer network. More particxilarly, the present 
invention concerns how to reimburse a merchant operating 
an Internet server when a consumer has accessed the Internet 
server and then later accesses another Internet server oper- 
ated by another merchant who has agreed to pay a referral 
fee. 

BACKGROUND OF THE INVENTION 

There are currently a number of advertising services in 
use on the Internet today. These advertising services facili- 
tate buying and selling advertising space on merchant web 
sites. If a merchant wishes to buy advertising space (i.e. 
wishes to pay to have advertisements displayed on other web 
sites), the merchant contracts such an advertising service, 
negotiates a contract, and pays according to terms of the 
contract. If a merchant wishes to sell advertising space (i.e. 
wishes to get something of value in exchange for displaying 
advertisements for other merchants), the merchant registers 
with such an advertising service, then places special adver- 
tisement hyperlinks on the merchant's web site. 

The term merchant is used here to indicate the owner or 
operator of a (computer) server linked to a network, such as 
the Internet, and able to publish information on the network. 
The information published by a first merchant could be 
pay-pcr-view information or an advertisement of goods and 
services offered by a first merchant, or the information could 
be an advertisement of goods and services offered by a 
second merchant, i.e. a referral to the second merchant. 
Various advertising systems have been developed to com- 
pensate a merchant for providing a referral to another 
merchant. 

In many advertising systems, compensation to merchants 
who sell advertising space (i.e. who advertise for other 
merchants) is computed in one of three ways: per 
impression, per visitor, or per sale. Often an advertising 
service computes and distributes compensation. In the per 
impression way of computing compensation, such an adver- 
tising service counts the number of unique consumers who 
view the advertisement, and the merchant receives a fixed 
fee for each. Advertising services that use this method are 
currently located at the following web sites: http:// 
www.doubleclick.com; http:/Avww.hyperbanner.com; http:// 
www.linkexchange.com; and http://www.smartclicks.com. 

In the per visitor (consumer) way of computing 
compensation, an advertising service counts the number of 
unique consumers who click on the advertisement, and the 
merchant receives a fixed fee for each. Advertising services 
that use this method include: http://www.aaddzz.com; http:// 
www.banDerbrokers.com; http://www.clicktrade.com; and 
http://www.eads.com. 

In the per sale way of computing compensation, a mer- 
chant receives a commission when a consumer clicks on an 
advertising linking the consumer to the server of a merchant 
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and the consumer subsequently purchases goods or services 
from the merchant through the linked access. 

On the Internet, computers access each other through the 
World Wide Web, a kind of network operating system. In 
this system, servers and consumer computers are said to 
reside at web sites. In the prior art of Internet advertising 
methods, it is common to use some standard procedure for 
identifying a consumer, or a consim:ier's computer, so as to 
track when the consumer accesses a merchant's web site, or 
when the consumer moves from one web page of a merchant 
(a quantity of intenmission at a web site) to another (at 
possibly another web site). The tracking is performed by 
software put in place by the advertising service. 

An advertising service may host, on a server operated by 
the advertising service, an actual advertisement for a 
merchant, as opposed to a link to an advertisement for the 
merchant. Then when a consumer selects to view, from a 
server operated by the merchant, a web page including an 
advertisement, the advertisement (i.e. the code for construct- 
ing its image for display as part of the web page) is actually 
pulled from the server of the advertising service by means of 
a link to the advertisement (io the code on the server, 
operated by the merchant, for constructing the web page). 
TTius, in an arrangement like this, the advertising service can 
record access by a consumer to an advertisement. 

Alternatively, an advertising service may set up, on a first 
server operated by the advertising service itself, an adver- 
tisement for a merchant's web page stored on a server 
operated by the merchant, but which includes a link to a 
second server operated by the advertising service. Then a 
consumer who accesses the first server and selects to view 
the web page is directed to the second server operated by the 
advertising service, which then directs the consumer to the 
server operated by the merchant where the advertised web 
page is located. In this arrangement, the second server of the 
advertising service records access by the consumer of the 
advertised web page of the merchant. 

Recording an access of an Internet server or of a web page 
on an Internet server is a feature of many commercial web 
servers. In providing this recording, such a web server may 
set, on consumer's computer, a so-called cookie (i.e. a 
persistent state data object, as described e.g. in U.S. Pat. No. 
5,774,670) that distinguishes the consumer from other 
45 consumers, at least for subsequent accesses to a server in the 
same second-level Internet domain as the cookie -issuing 
web server. In the context of the present invention, a cookie 
is a data object that resides on a consumer's computer and 
can be updated by the web server that set the cookie on the 
consumer's computer. Such updating is performed to record, 
for example, a total number of visits, each visit by the 
consumer to the cookie-issuing web server. Whether or not 
a cookie is used in tracking a consumer, a web server may 
append, for later inspection, information about the consum- 
er's computer (such as its network address) to a local log file 
(in memory or on storage media). Such consumer tracking 
is widely used, and is regarded as a valuable source of 
marketing information. 

Thus, the consumer activity on the web leading up to 
viewing a merchant's web page does not flow according to 
any one particular structure at the code level; there are many 
ways a consumer might arrive at a web page, depending on 
what mechanisms the merchant and advertising service 
chose to use. In addition, there are many tracks through the 
web a consumer might take in ending up at a particular web 
site having a web page the consumer wants to view. A 
consumer might arrive at a web site by first looking up 
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information in a directory service or search engine. Or a consumer visits a web site of the paying merchant, the 
consumer might arrive at a web site by following a helpful 




sequence of hyperlinks, possibly pointing to several other 

merchant web sites in the process. ^ 

"because of this diversity of activity leading to a consumer 5 ^mea^foLaccepiin^^^ 

viewing a particular web page, there is currently no robust J^EE^ntv^ 

mechanism to determine how the owner of the particular ^""^^ merch-amTm^ to 

. . , , J.. u * u u participating merchants the referral pomts according to 

web page might compensate or credit merchants whose web Criteria thaUimits the number of participating merchants! the 

sites were possibly instrumental in the consumer ultimately criteria including a requirement that the consumer have 

viewmg the parUcular web page. What is needed is a way to ^Q^vlglidl^ fcb^te of a partiapating merchant be fore visiting 
determme what server-operating merchants to compensate,' the pr e-determine?wegsiteof the p'aying merchant; wberem 

if any, for a consumer viewmg a web page of another "ItErffieans for distributing to participating mercharits uses a 

merchant who is willing to reward for potential referrals to pre-agreed pass-on percentage for each participating 

the web page. merchant, the pass-on percentage indicating what percent- 

TK;f N>i ADV ™c iMA/tTNTrT AW Tticnal poiuts thc participating merchant agrees 

SUMMARY OF THE INVENTION to pass on to other participating merchants who satisfy the 
Accordingly, it is an object of the present invention to criteria for receiving a portion of the referral points, 
determine which server-operating merchants to reward in ^^i^ another aspect of the present invention, the above 
the event of a consumer accessing a web page of a merchant object is achieved by an architecture, for use on a computer . 
who desires to make compensation for referrals to the web network, for executing a service of distributing a reward 
page. It is a further object of the present invention to ^ P^5^g merchant to participating merchants, the 
determine how much to reward such server-operating mer- P^^^^S merchant and participating merchants all operating 
chants servers connected to the computer network, the reward to be 
rrSrpSi^invention achieves this object by a method, „ distributed after a consumer visits a web site of the payit^ 
' for use OD a computer network, for distributing a reward " ?>e«=h»nt,.>be architecture comprismg: a checkpoint server, 
from a paying merchant to participating merchants, the for recording each access by the consumer of a partiapating 
paying merchant and participating merchants aU operating ' access by the consumer of the 
servers connected to the computer network, the rewiTd to be Paying merchant web site; an accounting server, for accept- 
distributed after a consumer visits a web site of the paying ,„ ""8 referral points issued by a paying merchant when a 
merchant, the method comprising the steps of: recording '° consumer acce^ a pre-determmed web sire of the paying 
each access by the consumer of a participating merchant '^V^^"''' ^""^ d>stnbutmg to participatmg merchajat the 
web site, including access by the consumer of the paying '^^'V^^ P?'°'^ |o cnteru. that Imit the number of 
merchant web site; accepting referral points issued by I P^'^P^^^ merchants, the cntena mc ludmg a requirement 
paying merchant when a consumer accesses a pre- „ 'ha' 'he consunier have visited a web site of a parti^^^^^^ 
determinedwebsiteof thepayingmerchant; and distributing " "^1°'* ""^T^ '"^ pre-determmed web site of the 
to participating merchants the referral points according to Paying merchant; and a merchant database server, for host- 
criteria that limit the number of participating merchants, the ""^ t '^^^'^^T^ ° mformation about each participating 
criteria including a requirement that the consumer have !"*f=5*°' "^"^ performmg the seivice, the mformation 
visited a web site of a participating merchant before visiting •^<='"*°g ! P'^'t Percentage and for paymg merchant 
the pre-determined web site of the paying merchant; wherein '° * number of referral pomts the paying naercbant agrees 
the distributing to participating merchants is calculated •» issue for distnbuUon to participatmg merchants whenever 
based on a pre-agreed pass^n percentage for each partici- " consumer visits an mdicated web site of the paying_ 
pating merchant, the pass-on percentage indicating what ^^^^ ' 

percentage of any referral points the participating merchant ^Jlas^Eresent JnvenU^ extends the prior art notion 

agrees to pass on to other participating merchanU who ^^[Jgf^vcrtismg on ttie interncpThe present invention is not 

satisfy the criteria for receiving a portion of the referral ^^^t^nded to reward aU merchants visited by a consumer on 

points ^° ^ paying merchant, or even only those merchant 

' "hTparticular embodiment of the present invention, the instrumental in the consume;-s visiting a web site of 

criteria include a requirement that the consumer visit a „ " P'^}"^, merchant; it distributes rewards only 

participating merchant within a pre-determined time before »PP™ately. makmg a tradeoff of accuracy for a lower 

4U J. - J i_ r *u burden or computation. The result IS a means of compen- 

thc consumer visits thc pre-determined web site of the *^ , . ^ . ^^^y^Li 

paying merchant in order for the participating merchant to some merchants in a sequence of merchants who 

be awarded a portion of the referral points. (only) potent.aUy referred a consumer to a paymg merchant, 

. . J. ^ . . - With httle burden on system performance. Because the result 

In another embodiment of the present invention, the 55 provides compensation to more than the merchant operating 

cntena include a requirement that after last visitmg a the web site a consumer visits just before visiting the web 

participating merchant before the consumer visits the pr^- of a paying merchant, the present invention is said to 

determmed web site of the paying merchant, the consurner nrovide multi.lev.l mn,mk..nneH ndvertkinf. 

not visit more than a pre-determmed number of other ^ ■ ^ — 

participating merchants in order for the participating mer- eo ^^'^ DESCRIPTION OF THE DRAWINGS 

chant to be awarded a portion of thc referral points. The above and other features and advantages of the 

In another aspect of the present invention, the above invention will become apparent from a consideration of the 

object is achieved by an architecture, for use on a computer subsequent detailed description presented in connection 

network, for distributing a reward from a paying merchant with the accompanying drawings, in which: 

to participating merchants, the paying merchant and partici- 65 FIG. 1 is a block diagram showing elements of an 

pating merchants all operating servers connected to the architecture used in compensating for referrals to a web 

computer network, the reward to be distributed after a page, according to the present invention; 
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FIG. 2 is a flow chart indicating how, according to the As a specific example of the present invention in the best 

present invention, a merchant prepares to participate in a mode, which will be described more specifically below, 

program providing referral fees; suppose that merchants m_l, m_2, m_3, and m_4 are the 

FIG. 3 is a flow chart indicating how, according to the only merchants registered with RPAS, and suppose mer- 

present invention, a merchant prepares to participate in a 5 chant m_4 agrees to award 2=10 referral points when a 

program providing referral fees; and consumer visits a web site of m_4, and that m_l, m_2 and 

FIG. 4 is a flow chart showing one way according to the ™— ^ ^""^ participating merchants in the scenario of this 

present invention to compensate merchants for rcfening a example. The referral points arc to be distributed by RPAS 

consumer to a web page of another merchant. participatmg merchants, according to whether each 

of the other participating merchants is identified as meeting 

DESCRIPTION OF THE INVENTION ^° the criteria used in the present invention to award referral 

INCLUDING BEST MODE points. 

Referring now to FIG. 1, an architecture 13 for a referral As will be described below, each participating merchant 

reward program according to the present invention is shown. ^^^s already agreed with RPAS to pass on some percentage 

The program is operated by a referral point awarding service .5 whatever referral points it is awarded. Suppose that the 

(RPAS). Merchants operating web sites on the Internet 15 ?lT^^i?!f ^T-h^-^ i^^^^ ^^^^ ^ 

register with the RPAS to become registered merchants. The ^^^'^ "^^'^ respectively, of whatever referral points 

referral award program rewards registered merchants who are awar e to em. 

have potentially referred consumers to the web site of a ^^w suppose that a consumer visits the web sites of 

registered merchant who has agreed to reward referral points P^icipaUng merchants m_l m_2, m_3 and m_4 m that 

through RPAS either when a consumer visits the web site of '° ^"^Z^ necessarily consecutively (i.e. the con- 

the plying merchant, or when a consumer has not only fu^". "itl^JL f LT. f u ^^"^ 

■ '* /*u u •* u * * 11 u J J • these four web sites). As the consumer visits each of these 

visited the web site but actuaUy purchased goods or services sites in turn, a checkpoint server 12 records the visit by 

using the web site. Such a registered merchant is caUed here entering either mode 1, mode 2, or mode 3. as wiU be 

a paymg mercdant. JHe registered merchants who are eU- ^5 described below. In this scenario, assume that the consumer 

giblc to receive a portion of the referral pomts are called here does not click on an advertisement redirecting the consumer 

participating merchants. In the best mode, a registered to m_4, but instead simply visits m_l, m_2, m_3 and 

merchant may be a participating merchant in one scenario m_4 in turn. 

(when a consumer accesses a server or visits a web site or when the consumer computer 14 interfaces with the web 

accesses a particular web page of the registered merchant 33 site of m_4, the visit prompts m_4's server to send a 

and eventually visits the web site of a paying merchant), and request to the checkpoint server 12 to issue z-10 referral 

a paying merchant in another scenario (when a consumer points. The checkpoint server 12 (operating in mode 3 as 

accesses a server or visits a web site or accesses a particular described below) then makes available to the accounting 

web page of the registered merchant for which the registered server 10 the recorded access information (i.e. that the 

merchant has agreed to award referral points). Each referral 35 consumer visited first m_l, then m_2, and so on) as weU as 

point represents something of value, such as frequent flyer the quantity of referral points paid by m_4. Finally, the 

miles or even money. accounting server 10 computes how to distribute the referral 

For the description provided here, a registered merchant points. Based on the percentages of referral points 

will be either a participating merchant or a paying merchant m_l, . . . , m_4 have each agreed to pass on, the accounting 

(but not sometimes one and sometimes the other). But it is 40 server 10, tracing the path of the consumer backwards from 

to be understood that, in the best mode, a registered mer- m_4, passes on 40% of 10 points (=4 points) fi-om m_3 

chant who has agreed to award referral points when a (leaving m_3 with 6 points), passes on 25% of 4 points (=1 

consumer ends up accessing material from a server of the point) from m _Z (leaving m_2 with 3 points), and there 

registered merchant, can be a participating merchant in case being no more participating merchants to reward, leaves the 

of_amnsurncr visiting some other paying merchant. 45 remaining 1 point with m„l. 

The architecture 13 includes various RPAS servers 10-12, It is important to note that nowhere in the example^was 

connected to the Internet 15, including an RPAS accounting there a requirement that to earn a reward a merchant must 

server 10 for awarding referral points when a suitable have actually influenced the consumer to visit, sooner or 

referral event occurs, an RPAS merchant database server 11 later, the web site of m_4. In fact, the compensation would 

for hosting a database of participating merchants including 50 have been the same even if the consumer has ended up at 

information about the merchants relevant to the referral m_4's web site purely by chance, i.e. without any 

reward program, and an RPAS checkpoint server 12 for suggestion, direct or indirect, by any of the "referring 

monitoring visits by consumers to web sites of the registered merchants" m_l, . . . , m__3. Thus, the method of the present 

merchants. In the preferred embodiment, there are several invention for rewarding a participating merchant is based on 

checkpoint servers, each serving different merchants. 55 the assumption that if a consumer visited the web site of a 

Connected to the architecture 13 through the Internet 15 participating merchant and then after not having visited too 

are a consumer computer 14, and merchant web sites 1-k of many other web sites, ended up visiting a web site of a 

registered merchants, the web sites indicated as merchant #1 paying merchant, the participating merchant was part of the 

web site 16, merchant #2 web site 17, merchant #3 web site stream of influence that swept the consumer onto the web 

18, . . . , and merchant #k web site 19. Although other 60 site of the paying merchant, and should therefore be 

merchants (not shown) might also be connected to the awarded. In the best mode, a participating merchant would 

Internet, it is assumed here that the merchants shown are all not receive a distribution of the referral points unless the 

registered with the RPAS, as described below, and that at consumer first visits a web site of the participating merchant, 

least one of these registered merchants is a paying merchant, and then visits less than a certain pre-determined number of 

i.e. one who has agreed to award referral points if a 65 web sites of participating merchants, not necessarily differ- 

consumer accesses a server of the merchant or visits a ent web sites, before visiting the web site of the paying 

particular web site of the merchant. merchant. ^ 
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Id another embodiment of the present invention, in order by the checkpoint server depends on what merchants the 

to foreclose as a possibility that a participating merchant consiuner visits. In the preferred embodiment described 

would receive all of a distribution of referral points because here, the consumer visits web sites on the Internet and 

a consumer repeatedly visits a web site of the participating accesses web pages of servers operated by participating and 

merchant and then finally visits the web site of the paying 5 paying merchants. The different modes will be here 

merchant, the referral points are distributed to a pre- described in the preferred embodiment, 

determined number of different participating merchants. In Mode 1 is entered by an RPAS checkpoint server when a 

this embodiment, for purposes of determining whether a consumer accesses a specially programmed web page of a 

particular participating merchant should receive a distribu- participating merchant. The participating merchant will have 

don of the referral points, only the last visit by a consumer lO embedded in the web page a data object that must be 

to a web site of the participating merchant is taken into retrieved from a server operated by the RPAS in order for a 

account. browser, operated by the consumer on the consumer's 

In another embodiment, as an alternative to setting a cap computer, to build up the web page on the consumer's 

on the number of last-visited participating merchants to computer. The retrieval of such a data object from an RPAS 

which referral points are distributed, the present invention is server provides RPAS with the information it needs to track 

also comprehends setting a time limit on when a consumer consumer, i.e. to note that the consumer visited the 

can have visited a participated merchant and then have particular participating merchant at a particular time. Mode 

visited a paying merchant, to determine whether to award 3 is entered in circumstances identical to those of mode 1, 

any referral points to the participating merchant. In yet except that in mode 3 the consumer has visited a paying 

another embodiment, there is both a time limit and a cap on 20 merchant, instead of a web page of merely a participating 

the number of participating merchants that will receive a merchant. (Remember, both participating and paying mer- 

distribution of any referral points. In this, it is possible that chants are "registered" with RPAS, and a registered mer- 

a single participating merchant would receive all of a chant can be either a paying merchant or a participating 

particular issue of referral points (if a consiuner visits only merchant, depending on whether a consumer accesses a web 

the single participating merchant in the pre-determined time 25 page for which the registered merchant has agreed to award 

before visiting the paying merchant), and it is also possible referral points.) 

that sometimes no referral points are awarded because no Mode 2 is entered by an RPAS checkpoint server when a 

participating merchants satisfy the criteria for receiving a consumer visits a web page of a participating merchant who 

portion of an issue of the referral points. embeds in the web page a data object that directs the 

In the best mode, with each participating merchant in the consumer to another participating merchant, in what 

merchant database (maintained by the merchant database amounts to a true referral, but that first directs the consumer 

server 11) there are associated various items of information, *° ^° checkpoint server so that RPAS can note that the 

including- consumer first visited to the referring participating 

a) a pass-on percentage, indicating, in a distribution of merchant, and then visited the referred to participating 
referral points, the percentage of the referral points , , . ^ , , , . . . 
received by the merchant that the merchant will pass on """^ ^' ""^ °^ the checkpoint server provided to the 
to other participating merchants; consmner computer a followed by appended mforinatton 

, , , / ,x . 'hat ucludes the identincaiion of a smgle registered 

b) a checkpomt umversal resource locator (url), i.e. a ^^^^^^ checkpoint server records that the con- 
network address of the checkpoint server to be used by ^^^^ ^^^^ y^^^^^ AdditionaUy, the 
the merchant (not oeedsd if all merchants use the saine .h^ckpoint server sets a cookie (the peisistent data Object 
checkpomt server); alternatively, instead of a check- ^^^^^ ^^ove) on the consumer computer; the cookie has 
for °a urh' ^ ^^"^ » timestamp and has the merchant identification appended to 
or a ur applications where security is an important enough 

c) at least one gateway url. I.e. a network address specified 45 issue, the cookie is either encrypted or foUowed by an 
by the merchant to be the url of a web site of the authentication string. After setting the cookie, the check- 
merchant (the database accommodates a merchant hav- point s^^ver returns to the consumer computer a data object 
mg multiple web sites by usmg a relaUonal database (essentially a web page and any associated information and 
structure); scripts). 

d) an account balance, indicating the current total number 50 In mode 2, the checkpoint server address is followed by 
of referral points earned by the merchant (and not yet the identification of two registered merchants. The check- 
redeemed); and point server records that the consumer visited the first 

e) a merchant identification, as a string of characters merchant, and then proceeded to the second merchant, 
unique to the merchant, used for identifying the Additionally the checkpoint server sets a cookie, with a 
account holding the referral points for the merchant. 55 timestamp and the two merchant identifications appended, 

In the preferred embodiment, a merchant registers with on the consumer computer. The checkpoint server returns to 

RPAS (e.g. via phone, fax, email, or web) and selects a the consumer computer data including a redirection causing 

pass-on percentage. Each participating merchant then the consumer computer to access the gateway url of the 

designs its web sites to trigger access by a consumer to the second merchant. 

merchant's checkpoint server, using known methods of 60 In mode 3, the checkpoint server address is followed by 

redirection in which a consumer is caused to access a the identification of a single participating merchant and a 

merchant's checkpoint server by providing the consumer's number of referral points. The address also includes, in the 

computer with the checkpoint url, along with appended best mode, a maximum number of participating merchants 

information. whom the paying merchant will compensate counting back 

In the preferred embodiment, a checkpoint server can 65 from the participating merchant most recently visited by the 

operate in any of three modes whenever a consumer visits a consumer before visiting the paying merchant, and counting 

participating or paying merchant. The particular mode used each participating merchant only once. Alternatively, the 
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address may instead include the value of a length of time, 
understood to be measured backward in time starting from 
when the consumer visits the web site of a paying merchant, 
beyond which a visit to a participating merchant by a 
consumer who later visits the paying merchant will not 
entitle the participating merchant to a share of any referral 
points made available by the paying merchant. (Here, a visit 
by a consumer to a merchant is intended to be understood to 
mean access by a consumer computer to a merchant web 
site.) The checkpoint server then proceeds as in mode 1, and 
also records a payment record (z,m,c,t,{n or s}) indicating 
that z points have been provided to merchant m by virtue of 
consumer c accessing the paying merchant's server at time 
t, and should be distributed among the most recent n 
participating merchants visited by the consumer, or among 



10 



It is to be understood that the above described arrange- 
ments are only illustrative of the application of the principles 
of the present invention. In particular, the present invention 
is intended to comprehend criteria for determining which 
participating merchants should receive at least some of an 
issue of referral points can be fashioned where the criteria 
include the possibility that even if only a single participating 
merchant is eligible, only a fraction of the issued referral 
points arc distributed. Numerous other modifications and 
alternative arrangements may be devised by those skilled in 
the art without departing from the spirit and scope of the 
present invention, and the appended claims are intended to 
cover such modifications and arrangements. 

What is claimed is: 

1, A method, for use on a computer network, for distrib- 



all participating merchants visited by the consumer within ^^^^g ^ reward from a paying merchant to participating 



the s seconds previous to the consumer visiting the paying 
merchant. 

One skilled in the art can understand how to use the access 
records created by the checkpoint servers to construct a 
database of consumer movements. Specifically, for each 20 
consumer who has triggered an access to a checkpoint 
server, one can list the participating merchants the consumer 
has visited, in chronological order. 

For each payment record (z,m,c,t,{s or n}), using infor- 
mation obtained from the one or more checkpoint servers 12, 25 
the accounting server 10 considers the (possibly and accept- 
ably incomplete) sequence of participating merchants 
accessed by consumer c. To eliminate anomalous behavior, 
in the preferred embodiment the accounting server may first 
filter through the sequence of participating merchants to 30 
remove those the consumer visited more than s second 
earlier than time t (when the consumer visited the paying 
merchant), and then removing all but one occurrence, such 
as the earliest occurrence, of each remaining participating 



merchants, the paying merchant and participating merchants 
all operating servers connected to the computer network, the 
reward to be distributed after a consumer visits a web site of 
the paying merchant, the method comprising the steps of: 

a) recording each access by the consimier of a participat- 
ing merchant web site, including access by the con- 
sumer of the paying merchant web site; 

b) accepting referral points issued by the paying merchant 
when a consumer accesses a pre-determined web site of 
the paying merchant; and 

c) distributing to participating merchants the referral 
points according to criteria that limit the number of 
participating merchants, the criteria including a 
requirement that the consumer have visited a web site 
of a participating merchant before visiting the pre- 
determined web site of the paying merchant; and 

wherein the distributing to participating merchants is calcu- 
lated based on a pre-agreed pass-on percentage for each 



merchant. In the case of using a maximum number n of 35 participating merchant, the pass-on percentage indicating 



to-be-compensated merchants, the RPAS accounting server 
filters out merchants visited by the consumer c earlier than 
the last n different participating merchants. Either way, the 
result of the filtering is a usually shortened list of merchants: 
m_l, m_2, . . . , m_k, where m_l is the paying merchant, 40 
and m_Jc is the first participating merchant the consumer 
visits after time t-s, or no more than the n*'' different 
participating merchant the consumer visits before visiting 
the paying merchant m_l. (So the path of the consumer 



backward in time, is: m_l (the paying merchant), then 45 referral points. 



what percentage of any referral points the participating 
merchant agrees to pass on to other participating merchants 
who satisfy the criteria for receiving a portion of the referral 
points. 

2. The method claimed in claim 1, wherein the criteria 
include a requirement that the consumer visit a participating 
merchant within a pre-determined time before the consumer 
visits the pre-determined web site of the paying merchant in 
order for the participating merchant to be awarded a portion 




2, and so on back to m_Jc 
^The accounting server 10 next redistributes the z referral 
points to the merchants in the filtered list according to one 
or another algorithm. In the best mode, the accounting server 
distributes the referral points among the participating mer- 
chants earning referral points based on the pass-on percent- 
age of each such merchant, as in the example discussed 
above (involving m_l, . . . , m_4, where m_l is the paying 
merchant, and ra 2 is the participating merchant the con- 
sumer visited just before visiting the paying merchant m_4, 
and so on). Such a distribution is expressed algorithmically 
in FIG. 4. In addition to the procedural steps shown in FIG. 
4, the accounting server may perform rounding up or down 
of referral points to be awarded, or may deduct service 
harges. 

Note that the accounting server 10 has all the information 
needed to prepare a pass-on list, i.e. a list providing referral 
points passed on to others by each participating merchant 
during a predetermined lime interval. Thus, the RPAS can 
prepare such a list for use by the registered merchants to help 65 
them determine how to optimize the value of the referrals 
they make. 



3. The method claimed in claim 1, wherein the criteria 
include a requirement that after last visiting a participating 
merchant before the consumer visits the pre-determined web 
site of the paying merchant, the consumer not visit more 
5Q than a pre-determined number of other participating mer- 
chants in order for the participating merchant to be awarded 
a portion of the referral points. ---^ 
/^4^An architecture, for use on a computer network, for 
distributing a reward from a paying merchant to participat- 
^3 ing merchants, the paying merchant and participating mer- 
chants all operating servers connected to the computer 
network, the reward to be distributed after a consumer visits 
a web site of the paying merchant, the architecture compris- 
ing: 

a) means for recording each access by the consumer of a 
participating merchant web site, including access by 
the consimier of the paying merchant web site; 

b) means for accepting referral points issued by the 
paying merchant when a consumer access a pre- 
determined web site of the paying merchant; 

c) means for distributing to participating merchants the 
referral points according to criteria that limits the 



60 



04/26/2004, EAST Version: 1.4.1 



us 6,289,318 Bl 



11 



12 



nximber of participating merchants, the criteria includ- 
ing a requirement that the consumer have visited a web 
site of a participating merchant before visiting the 
prc-detcrmined web site of the paying merchant; 
wherein the means for distributing to participating mer- 5 
chants uses a pre-agreed pass-on percentage for each par- 
ticipating merchant, the pass-on percentage indicating what 
percentage of any referral points the participating merchant 
agrees to pass on to other participating merchants who 
satisfy the criteria for receiving a portion of the referral lo 
points. 

5. The architecture of claim 4, wherein the criteria 
includes a requirement that the consumer visit a participat- 
ing merchant within a pre-determined time before the con- 
sumer visits the pre-determined web site of the paying is 
merchant in order for the participating merchant to be 
awarded a portion of the referral points. 

6. The architecture of claim 4, wherein the criteria 
includes a requirement that after last visiting a participating 
merchant before the consumer visits the pre-determined web 20 
site of the paying merchant, the consumer not visit more 
than a pre-determined number of other participating mer- 
chants in order for the participating merchant to be awarded 

a portion of the referral points. 

7. An architecture, for use on a computer network, for 25 
executing a service of distributing a reward from a paying 
merchant to participating merchants, the paying merchant 
and participating merchants all operating servers connected 

to the computer network, the reward to be distributed after 
a consumer visits a web site of the paying merchant, the 30 
architecture comprising: 

a) a checkpoint server, for recording each access by the 
consumer of a participating merchant web site, includ- 
ing access by the consumer of the paying merchant web 
site; 



b) an accounting server, for accepting referral points 
issued by the paying merchant when a consumer 
accesses a pre-determined web site of the paying 
merchant, and for distributing to participating mer- 
chants the referral points according to criteria that limit 
the number of participating merchants, the criteria 
including a requirement that the consumer have visited 
a web site of a participating merchant before visiting 
the pre-determined web site of the paying merchant; 
and 

c) a merchant database server, for hosting a database of 
information about each participating merchant needed 
in performing the service, the information including a 
pass-on percentage, and for a paying merchant also a 
number of referral points the paying merchant agrees to 
issue for distribution to participating merchants when- 
ever a consumer visits an indicated web site of the 
paying merchant. 

8. The architecture of claim 7, wherein the criteria include 
a requirement that the consumer visit a participating mer- 
chant within a pre-determined time before the consumer 
visits the pre-determined web site of the paying merchant in 
order for the participating merchant to be awarded a portion 
of the referral points. 

9. The architecture of claim 7, wherein the criteria include 
a requirement that after last visiting a participating merchant 
before the consumer visits the pre-determined web site of 
the paying merchant, the consumer not visit more than a 
pre-determined numt)er of other participating merchants in 
order for the participating merchant to be awarded a portion 
of the referral points. 
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